5 ms·

or, you could just do passwordless email auth and not have any security issues whatsoever.

mynameisvlad 6y ago
Sure, because “do passwordless emails” is just a snap of the finger away, right? The point is that doing auth properly is hard. Sending an email might be easy, but creating and managing the session in a secure fashion is hard, even if you’re “just doing passwordless email auth”.
- yannoninator 6y ago
  > Sure, because “do passwordless emails” is just a snap of the finger away, right? uh, yes? https://magic.link/ https://magic.link/ > The point is that doing auth properly is hard... it works just like password reset no? there's not much state with passwordless email auth as opposed to passwords.
  - mynameisvlad 6y ago
    This whole comment thread is about not outsourcing your user management stack to a third party and your intended suggestion is.... A different third party? I don't think I understand exactly what your argument is.
    - yannoninator 6y ago
      You said: > Sure, because “do passwordless emails” is just a snap of the finger away, right? And I showed it literally is. The choice is yours to reimplement this authentication system, but in terms of "a snap of the finger away", You can do that, That is all. I've done these type of systems before at scale and it took minutes to do (works just like a password reset mechanism) and it is very trivial. In your original comment above, I think you are projecting this a bit too much.
      - chickenpotpie 6y ago
        Top comment: why would you trust a 3rd party with accounts? Next Comment: Because they are better at security Your comment: Or you can do passwordless yourself and have no security problems Next comment: You can't just do passwordless with a snap of the finger Your comment: Yeah just use a 3rd party You're incorrect about the thread
        mynameisvlad 6y ago
        Ok it’s not just me then. I felt like I was taking crazy pills when reading the replies, and the ones to the sibling comment thread where they pivoted to talking about personal security with magic links when this entire conversation has been about companies implementing user management solutions.
        yannoninator 6y ago
        This is a very reductionist assessment of the thread and glosses over one important detail I said here: > The choice is yours to reimplement this authentication system, but in terms of "a snap of the finger away", You can do that, That is all. It doesn't matter if it's a 3rd party, it is still an option that exists "a snap of the finger away", which was my response to that comment, this type of system can be done in an hour, 3rd party or library. But if you want to speed things up, then there's your solution. That was the point, but go ahead and try and reduce and spin this to your own interpretation.
chickenpotpie 6y ago
“Not have any security issues whatsoever” is literally impossible. Passwordless auth is the security equivalent of putting all your eggs in one basket. If someone hacks a users email account, now they have access to your service too. Now I’m pissed that you didn’t let me enable 2fa to prevent that or have multiple secure passwords to isolate the hack to my email. You could have just shelled out the 10 cents it would have cost to have my account in auth0 and prevent all of this with 2fa and fraud detection.
- yannoninator 6y ago
  just use a fake email? you don't have to use your real email for everything, even google has forwarding addresses. and apple has private/forwarding emails as well, so this is a moot point.
  - chickenpotpie 6y ago
    Forwarding email increases risk of being hacked. They only have to get one of the emails to get into my account.
    - yannoninator 6y ago
      So you hack apple's private forwarding email service right, how would one get in? I've even used G Mail's forwarding email for 6 years and I've never been hacked. If you're concerned about this just use a fake email.
      - chickenpotpie 6y ago
        You’ve gone off on a personal tangent about how I as a user can increase my security. The topic of discussion was you claimed passwordless security had no security issues and I pointed out possible security issues. An individual can mitigate them, but they still exist
        yannoninator 6y ago

Sure, because “do passwordless emails” is just a snap of the finger away, right? The point is that doing auth properly is hard. Sending an email might be easy, but creating and managing the session in a secure fashion is hard, even if you’re “just doing passwordless email auth”.

yannoninator 6y ago
> Sure, because “do passwordless emails” is just a snap of the finger away, right? uh, yes? https://magic.link/ https://magic.link/ > The point is that doing auth properly is hard... it works just like password reset no? there's not much state with passwordless email auth as opposed to passwords.
- mynameisvlad 6y ago
  This whole comment thread is about not outsourcing your user management stack to a third party and your intended suggestion is.... A different third party? I don't think I understand exactly what your argument is.
  - yannoninator 6y ago
    You said: > Sure, because “do passwordless emails” is just a snap of the finger away, right? And I showed it literally is. The choice is yours to reimplement this authentication system, but in terms of "a snap of the finger away", You can do that, That is all. I've done these type of systems before at scale and it took minutes to do (works just like a password reset mechanism) and it is very trivial. In your original comment above, I think you are projecting this a bit too much.
    - chickenpotpie 6y ago
      Top comment: why would you trust a 3rd party with accounts? Next Comment: Because they are better at security Your comment: Or you can do passwordless yourself and have no security problems Next comment: You can't just do passwordless with a snap of the finger Your comment: Yeah just use a 3rd party You're incorrect about the thread
      - mynameisvlad 6y ago
        Ok it’s not just me then. I felt like I was taking crazy pills when reading the replies, and the ones to the sibling comment thread where they pivoted to talking about personal security with magic links when this entire conversation has been about companies implementing user management solutions.
      - yannoninator 6y ago
        This is a very reductionist assessment of the thread and glosses over one important detail I said here: > The choice is yours to reimplement this authentication system, but in terms of "a snap of the finger away", You can do that, That is all. It doesn't matter if it's a 3rd party, it is still an option that exists "a snap of the finger away", which was my response to that comment, this type of system can be done in an hour, 3rd party or library. But if you want to speed things up, then there's your solution. That was the point, but go ahead and try and reduce and spin this to your own interpretation.

chickenpotpie 6y ago

“Not have any security issues whatsoever” is literally impossible. Passwordless auth is the security equivalent of putting all your eggs in one basket. If someone hacks a users email account, now they have access to your service too. Now I’m pissed that you didn’t let me enable 2fa to prevent that or have multiple secure passwords to isolate the hack to my email. You could have just shelled out the 10 cents it would have cost to have my account in auth0 and prevent all of this with 2fa and fraud detection.

yannoninator 6y ago
just use a fake email? you don't have to use your real email for everything, even google has forwarding addresses. and apple has private/forwarding emails as well, so this is a moot point.
- chickenpotpie 6y ago
  Forwarding email increases risk of being hacked. They only have to get one of the emails to get into my account.
  - yannoninator 6y ago
    So you hack apple's private forwarding email service right, how would one get in? I've even used G Mail's forwarding email for 6 years and I've never been hacked. If you're concerned about this just use a fake email.
    - chickenpotpie 6y ago
      You’ve gone off on a personal tangent about how I as a user can increase my security. The topic of discussion was you claimed passwordless security had no security issues and I pointed out possible security issues. An individual can mitigate them, but they still exist
      - yannoninator 6y ago